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Abstract 



^ ■ Correlations of the type discussed by EPR in their original 1935 paradox 
for continuous variables exist for the quadrature phase amplitudes of two 

. spatially separated fields. These correlations were experimentally reported 

K*" ! in 1992. We propose to use such EPR beams in quantum cryptography, to 

I transmit with high efficiency messages in such a way that the receiver and 

' sender may later determine whether eavesdropping has occurred. The merit 

o\ ■ 
o 

. yet predetermined key. This would allow relay of a cryptographic key over 

i long distances in the presence of lossy channels. 



Intriguing is the possibility of using quantum mechanics to transmit signals in a way that 
P5 ■ any eavesdropping can be detected by the receiver and sender. This new field of quantum 
^ . cryptography Sff has attracted much attention. 

qh| In the pioneering proposal of Bennett and Brassard the sender (Alice) transmits to 

the receiver (Bob) photon pulses in one of two orthogonal polarisations (labeled and 1), 
where the orientation (basis) of polarisation randomly shifts between 0° and 45°. The 0, 1 
choice of polarisation represents the bit value. Bob randomly selects a basis (0° or 45°) for a 
polarisation measurement, and records the resulting bit value. Alice and Bob later compare 
notes, through a public channel, on the sequence of orientations (0° or 45°) chosen. The bit 
sequence where Bob selected the same orientation as Alice forms a key, to be used later to 
encrypt messages. While classically an eavesdropper could measure with perfect accuracy 
components of polarisation along both directions, quantum mechanics forbids this by way of 
the uncertainty principle. As a consequence the eavesdropper cannot always regenerate the 
original state transmitted by Alice. The resulting discrepancy between the results recorded 
by Alice and Bob gives warning to the interference by the eavesdropper. No discrepancy 
implies a secure key. 

Other proposals 0, such as that suggested by Ekert, propose to use a sequence of two 
spatially separated photons with correlated polarisation, and whose joint polarisation mea- 
surements are predicted by quantum mechanics to show a violation of a Bell inequality 0. 
Such fields have no local hidden variable interpretation. Any measurement, and subsequent 
state regeneration to mask interference, by an eavesdropper along one of these two channels 
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will alter the statistics so that a Bell inequality is always satisfied. Again a fundamental 
aspect of quantum mechanics is utilized to alert receiver and sender to eavesdropping. 

The majority of proposals so far focus on the use of single photons to transmit informa- 
tion. A significant current limitation to the practicality of such schemes is the poor efficiency 
of photon counting detectors. This contributes to a significant loss factor which makes direct 
efficient communication of sequences predetermined by Alice difficult. Photon-based pro- 
posals rely in practice on establishing a sequence (key) a posteriori from infrequent detected 
photons. 

Recently Ralph and Hillery B have suggested cryptographic schemes based on mea- 
surement of (continuous variable) field quadrature phase amplitudes. In their proposals 
Alice transmits a bit value by way of squeezed signals, which means that the fiuctuation 
in one quadrature phase amplitude is reduced to a level below that corresponding to the 
standard quantum limit as determined by the uncertainty principle. Security is provided 
as a result of the uncertainty principle since an eavesdropper (Eve) cannot measure both 
noncommuting quadrature amplitudes to arbitrary accuracy. As a result Bob's signal after 
Eve's interference will contain extra noise, detectable when Alice and Bob compare the bit 
values received by Bob with the bit values sent by Alice. In this way, following the example 
of Bennett and Brassard, a secure key can be established. 

In this paper it is suggested to use continuous variable measurements in such a way 
so as to allow transmission of a predetermined sequence (or key) directly from sender to 
receiver. Later, communication through a public channel can check whether eavesdropping 
has occurred. Security is provided not by comparison of Bob's received with Alice's sent bit 
values, but by establishing whether Einstein-Podolsky-Rosen correlations 1^ between two 
beams, one retained by Alice and the other transmitted with signal to Bob, are maintained 
after transmission. In this last respect the proposal is not unlike the photon-based proposal 
of Ekert where security is based on the confirmation by Alice and Bob of a violation of a 
Bell inequality. 

The scheme involves only quadrature phase amplitude measurements, which can be per- 
formed with high efficiency. The predetermined nature of the sequence takes most advantage 
of this high efficiency, since every bit value sent can contribute to the final message. This 
contrasts with previous schemes for which part of the sequence, randomly selected after 
transmission, is used only to establish security by way of the public channel. 

The predetermined nature of the sequence could also aid incorporation of special re- 
peaters, where the signal and correlated beams are regenerated to help compensate for 
transmission loss. This method could potentially secure a single key between a single sender- 
receiver pair a long distance apart. 

Correlations of the type discussed by Einstein, Podolsky and Rosen (EPR) in their orig- 
inal 1935 paradox § , for continuous variables, exist for the quadrature phase amplitudes of 
two spatially separated fields 0. The technology of quadrature phase amplitude measure- 
ment is sufficiently advanced that in 1992 these correlations were detected, without detection 
efficiency problems, by Ou et al il . Such EPR correlated beams have recently been utilized 
to enable quantum state teleportation with continuous variables @. Further work has 
shown that quadrature phase amplitude measurements on certain twin beams can predict 
violations of Bell inequalities. 

Consider the nondegenerate parametric down conversion process, modeled by two field 



2 



modes with boson operators a and 6, with the interaction Hamiltonian Hi = ihK^a^b^ — ah). 
We define the quadrature phase amphtudes = (a + a''"), Pq = (d — a^)li, X^, = {h + b^) 
and Pf, = {b — b^)/i. The Heisenberg uncertainty relation for the orthogonal amplitudes of 
mode a is A^XqA^Pq > 1. The output quadrature amplitudes are 

Xait) = XaiO)cosh{Kt) + Xb(0)sm/i(Kt) 
Xh{t) = Xi,{0)cosh{Kt) + Xa{0)sinh{Kt) 
Pa{t) = Pa{0)cosh{Kt) - Pb{0) sinh{Kt) 

Pj,(t) = A(0)cos/i(Kt) - PaiO)sinh{Kt). (1) 

where k is proportional to the strength of parametric interaction and the t = operators 
represent inputs. As nt increases, Xa(t) becomes increasingly correlated with Xbit), and 
Pa{t) becomes increasingly correlated with —Ph{t), the correlation becoming perfect in the 
limit kT — s> oo. With output fields a and b spatially separated, this is the situation of 
the 1935 EPR correlations. 

For imperfect correlation, the degree of correlation may still be sufficient to ensure EPR 
correlations fl. The results for measurements Xa{t) and Xh{t) (or Pait) and Pb{t)) can be 
compared, yielding an estimate of the error in inferring the result of measurement Xa{t) 
on mode d, based on a measurement Xh{t) on mode b. We calculate 6^ = Xa{t) — 'yXf,{t) 
and 6p = Pa{t) + '~fPb{t), where the factor 7 may be modified to give the minimum error. 
One can calculate the variances associated with the inference of Xa from jXb, and Pa from 
•yPb'. A^ j„j =< 6l > — < 6x >^ and A^^^j =< 6p > — < 6p >^. The minimum variance 
^x,inf,min (^^^ A^ .^^ mm^ occurs for a particular value of 7. Finding the turning point with 
7 yields (with 7 =< X,(T), X,(T) > / A^X,(T)) Al - ^niT)Axim-i<xjT)MT)>? 



f,min — Axf(T) ' 

where < x,y >=< xy > — < x >< y > and one deduces a A^ in similar fashion. 

EPR correlations are obtained when the product A^ ^^jAp drops below the quantum 
hmit given by A^X^A^P^ > 1 §: 

For arbitrary coherent input states, we predict from (1) (7 = tanh2Kt) 

^x,inf,min — ^p,inf,min — l/cOsh2fi:t (3) 

An identical argument and results hold if the measured operators are Xa— < Xa >, Xb— < 
Xb >, Pa— < Pa > and Pb— < Pb >, the fluctuations about the mean, as opposed to Xa, 
Xb, Pa and Pb- 

With vacuum inputs to d and b. Bob and Alice can secure a random key, using the po- 
tentially perfect correlation between quadrature amplitudes. We propose a different scheme, 
to allow for predetermined sequences, and imperfect correlation. For the purposes of cryp- 
tography (Figure 1), Alice chooses as input to the nondegenerate parametric amplifler one 
of two possible states: the input for d is either a coherent state |q;o exp*'^/'' >„ (bit value 
1) or a coherent state |aiexp*'^/^ >a (bit value 0), where ao and ai are real. The input 
for 6 is a vacuum state |0 >b. The signal is transmitted by spatially separating the two 
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output fields and propagating to Bob the output field of mode a. Bob can read the mes- 
sage by measuring either Xa{t) or Pa{t). Suppose Bob chooses to measure Xa{t). The 
probability distribution for his obtaining a result a;, given Alice's choice |q;o ^xp'"^/"^ >, is 
the gaussian exp [—{x — \/2q;o cosh fi;t)^/2cr^]/cr\/^ with mean \/2q;o cosh ret and standard 
deviation a — Vcosh 2Kt. If Alice chose jctiexp*'^/^ > the probability for Bob's outcome is 
exp [— (.T — y2ai cosh Ktf/2a'^]/a\/2n, the gaussian mean shifted by a/2(q;o — ai) cosh/tt. 
Provided a <^ \/2(ao — cti) cosh/tt, the bit value is clearly determined from Bob's result x 
(Figure 2): x near \/2q;o cosh implies 1; x near \/2q;i cosh implies zero. The bit value 
can also be determined by a measurement of quadrature phase amplitude Pa{t), in this case 
the input \ao exp*'^/^ > giving a gaussian distribution about \/2ao cosh Kt (bit value 1), while 
laiexp*"^/^ > gives a distribution centered about \/2q.i cosh/ct (bit value 0). 

Bob records the results of his consecutive quadrature phase measurements, randomly 
selecting to measure either Xa{t) or Pa{t), and subtracting from his result either \/2ao cosh nt 
or \/2ai cosh Kt, so that only the fluctuation about the mean of the particular distribution is 
recorded (Figure 2). Bob then communicates to Alice, through a public channel, the sequence 
of recorded fluctuations together with measurements {Xa{t) or Pait)) chosen (the bit value 
itself is not communicated). Alice also makes a sequence of consecutive measurements Xfe(t) 
or Pb{t), (preferably) to coincide with Bob's measurement sequence, and records similarly 
only the fluctuation about the mean (in this case \/2ao sinh nt or \/2ai sinh nt for Xh, and 
—y/2ao sinh Kt or — y/2ai sinh Kt for Pb). Bob and Alice compare notes, through the public 
channel, to calculate a A^j^jA^j^^. The predicted minimum is, for optimized 7, given by 
(3). 

Verification by Bob and Alice of the EPR correlations A^ mf^p mf < ^ gives an indication 
of interference by an eavesdropper (Eve). Let us consider various practical options by Eve. 
To determine the signal Eve's first obvious choice may be to capture the field a and measure 
either Xa or P^. If she is able to predetermine correctly for each bit value the choice {X^ 
or Pa) to be made by Bob, Eve can make the same choice and conceal her eavesdropping. 
However Bob's choice is delayed until after his detection of a forcing errors in Eve's selection. 
Quantum mechanics makes it impossible for Eve to measure both amplitudes {Xa and Pa) 
to an uncertainty better than that given by the Heisenberg uncertainty relation. More 
importantly. Eve cannot regenerate and transmit to Bob a single mode state with both 
well defined X and P, but is limited by A^XA^P > 1. For example Eve may select to 
measure Xa rather precisely so that the error in the measurement is of order A^^ = 1/r, 
where r > 1. Eve may then generate, to transmit to Bob, a "squeezed" state with this 
reduced fiuctuation in X, so that the new operator describing the quadrature measurement 
now made by Bob is X^*^^ — Xa + SXa where Xa is the result of Eve's measurement and 
A'^6Xa = 1/r. Quantum mechanics compels an enhanced fluctuation in P, so that the 
operator describing the quadrature measurement Pa made by Bob on this retransmitted 
state is P^^"^ = + SP^ where at best A^(5P = r for a minimum uncertainty squeezed 
state. The variances A^ .^^^-^ and A^ -^j^-^ testing for supposed EPR correlations are 
now A2„,„^^„^„^.^ = ^l,inf,min + ^^<^^a and /^lne^^inf,min = K,raf,min + ^^^P^ ^here here 
we have /^l^i^f^min = ^p,m/,mm = 1/ cosh Ki. This gives A%inf,min^l,inf,rnin > 1= and EPR 
correlations are lost, making a sensitive test for interference on a. We note that it is possible 
for Eve to gain access to bit values, but whether this has occurred is later checked by 
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communication between sender and receiver. 

To improve her chances, as discussed by Ralph 0, Eve may alternatively opt to make 
a partial interference of beam a by tapping off only part of the beam using a partially- 
transmitting beam splitter, with a and a^ac as inputs, where a.uac is a vacuum input (Figure 
3). The outputs are: a^ofe = + ^1 — rjCivac, the field transmitted and detected by Bob; 
and a Eve = a/1 — rja — y/rjdyac, the field detected by Eve to allow her measurement of Xa- 
Here 1] gives the fraction of photons transmitted, on to Bob, by the beamsplitter. We define 
the quadrature amplitudes Xf °^ = dsob + a^Bob^ P^°^ = {dsob - sLfe)/^' ''^ = "-Eve + ^Le 
and Pa^^ = {cLEve — o^Eve)/^- ^ vacuum input we have ^^X^ac = ^^Pvac = 1- 



Pa'^'it) = VvPvac - Jl^Pait) (4) 



The variances ^x,inf,min ^p,inf,min l^t^r mcasurcd by Alice and Bob, testing for EPR 
correlations, are now 

^a;"<=™,m/,mm ~ V^x,inf,min ~^ ~ Xyac 

^p^^^ ,inf,min ~ V^p,inf,min + (-'- ~ Pvac (S) 



With T] ^ 1 the back-action noise (a/1 — rfX^ac for measurement X) feeding into Bob's sig- 
nal as a result of Eve's tapping is decreased. In this limit, the change (1 — ri)A'^Xyac and 
(1 — ri)A'^Pyac to the variances A^. and respectively, as a result of Eve's eavesdrop- 

ping becomes increasingly undetectable. Eve however pays the price, since she observes a re- 
duced signal (— Y^l — TjXait) for the measurement X) with increased noise (due to y^X^^c), 
limiting her ability to obtain information from the channel. Witn noise ^JfjX^ac from the 
vacuum input increasing as ^ 1, a point is reached where she can no longer resolve the 
two peaks, separated by v^a/1 — rf cosh Kt{aQ — ai), giving the bit value. 

In an effort to reduce the feedback noise (1 — ifj/S^X^ac in Bob's signal, and to allow 
better resolution of the bit value for larger rj, Eve may choose to perform a quantum non- 
demolition measurement of quadrature amplitude Xa (Figure 3). Such measurements allow 
accurate determination of Xa (to A^X < 1) and have been achieved experimentally 0. 
The quantum nondemolition measurement may be performed using the beam splitter as 
above (Figure 3) but where a^ac is a squeezed vacuum input so that A^X^^c < 1 (suppose 
AX^ac = ^/^)- Increased squeezing of the fluctuation in X^ac (A^X^,ac — > 0) implies that 
Xf°^(t) = y/T]Xait) and X^"^ = -^/T^Xaif) and perfect inference of X„(t) is obtain- 
able by Eve, without any feedback vacuum noise in the value Xsobif) later measured by 
Bob. However large fluctuations in P^ac ("we must have AP^ac = r to satisfy the uncertainty 
principle for the squeezed vacuum input state) necessarily create a large noise in Pa°^. 



Pa{t) = VvPait) + Vl - VPvac (6) 

This excess noise, detectable when Bob selects to measure P rather than X, causes an 
increase in A^^.^ = t^A^ + (1 - v)^'^Pvac, alerting Bob to Eve's interference. 
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The presence of loss due to transmission will also reduce the EPR correlation. Loss (and 
detection inefficiencies) may be modeled by a beam splitter which mixes our signal mode a 
with a vacuum field a^ac to give a new output at Bob's detector: a"'^"' = ^Jfja + a/1 — rja^ac- 
Here r] is the overall efficiency factor (77 — > 1 for no loss). The new noise levels measured by 
Bob are 

'-^x"<^^ ,inf,min '/ '-^x,inf,min ^ 'I J 

^p-nevj ^lnf,min ~ V ^p,inf,min ~^ ~ V )■ (''') 

With 7] > 0, a. partial loss, EPR correlations are still maintained, though decreased. For 
complete loss we obtain A2„,„_.„^_^.„ = A^^.^ = 1. 

In practice, the degree of EPR correlation for a given transmission line and distance 
would be accurately established. This degree of correlation is independent of Alice's bit 
value. Any increase of our EPR noise indicator above this pre-evaluated level alerts Bob to 
the additional loss caused by a partial tapping of the channel by Eve. 

Security is also provided by comparing individual results of measurements made by Alice 
and Bob. For a given transmission line and loss along this line, and for a given bit value 
(based on the choice a) the mean and shape (the shape is predicted to be independent of the 
bit value) of the measured distribution can also be accurately recorded. A specified result for 
the measurement (or fiuctuation about the mean) made by Alice will imply a conditional 
probability distribution for the measurement (or fiuctuation about mean) Xa made by Bob. 
In the absence of loss the variance of this conditional distribution is A^^„j Loss increases 
the variance by the amount given above in (7). Significant deviation of a result for Bob from 
this distribution is indication of Eve's presence. Importantly loss acts to increase noise levels 
in X and P equally. Marked increase, for some of the bit values sent, in the deviation of 
Bob's measurement from Alice's predicted result for Bob would alert Alice and Bob to the 
possibility of Eve having performed a quantum nondemolition measurement as discussed 
above. 

Eve's best chance then may be to perform measurement with a partial beam splitter 
with standard vacuum input, in the hope that the extra noise put back into Bob's channel 
will not be noticeable over loss. To safeguard against this Alice and Bob must evaluate by 
measurements the minimum extra noise, or additional loss, for which they would conclude 
the existence of a potential eavesdropper. With this value of rj Eve could have performed 
a measurement (4) and would be compelled to infer a bit value based on extra noise levels 
as indicated by (4). Bob and Alice must select the difference between inputs ao and ai so 
that Eve is unable to resolve the bit value with this extra noise. 

Schemes using the violation of a bell inequality § can also be proposed for continuous 
variable quadrature phase detection, since the failure of local realism has recently been 
predicted possible for such measurements, for certain types of quantum states. One such 
state is the pair-coherent state 

1^ >= N r \r^e'' >a \roe-'' >, (8) 



Here is a normalization coefficient, we choose tq = 1.1 and \a >q {q = a,b) is a coher- 
ent state for the mode q. Also we might consider the two-mode "Schrodinger cat" state 
undergoing interaction for a time t with a parametric amplifier 
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I* >= NU (|ao >a |/5o >b +1 - «o >a I - >h) (9) 

where U = exp [—iHjt/h], and we choose = = 0.9 and K,t = 0.6 Our protocol is not a 
direct parallel of Ekert's for spin-1/2 particles, because for states (8) and (9) there is not a 
perfect correlation between quadrature amplitude measurements on d, b. 

After generation of the state (8) (or (9)), the two fields d and b are spatially separated. 
Alice may then choose to phase shift the field d by 180° or not, this choice of relative 
phase between d and b being her signal. The field d is then propagated to Bob at a distant 
location A. The signal is transmitted from Alice to Bob in the form of blocks, consisting 
of many (A^ say where A^ is large) identical states with the same value of phase shift. Bob 
measures at a location A a quadrature phase amplitude = Xa cos 9 + Pa sin 9 for each 
state comprising a certain block, where 9 randomly varies between 9 = 0, 7r/2, 37r/2, for 
state (8) (or between 9 = 0, 0.427r, -0.287r, 1.427r, 0.727r for state (9)). Alice also makes a 
series of measurements X^ = Xbcoscp + Pb sin (p at a location B, where randomly varies 
between = 0, — vr/4, — 37r/4, for state (8) (or between = 0, — 0.287r, 0.427r for state (9)). 
Alice then communicates to Bob through a public channel the results for her quadrature 
phase amplitude measurements. 

Bob may build up, for each block, the probability distribution P{qa, qt) for getting results 
Qa and Qb upon measurement of Xa at d and Xb at b respectively. This information is given 
by the 9 = and = measurements. The shape of the distribution changes with the 
choice of phase shift, and gives the bit value. This information is not determinable from 
the measurements of amplitudes made on b alone, and hence cannot be determined by the 
information passed along the public channel. 

To check whether eavesdropping has occurred. Bob tests for a Bell inequality. The result 
of the measurement is classified as +1 if the quadrature phase result x is greater than or 
equal to zero, and —1 otherwise. We define the probability distributions: P^{9) for obtaining 
+1 at d upon measurement of P^{4>) for obtaining +1 at 6 upon measurement of X^] 

and P^f{9, 0) the joint probability of obtaining a +1 result at both d and b. The existence 
of a local hidden variable theory implies the "strong" Bell-Clauser-Horne inequality @. 



p^f (0, 0) - P^f(MO+^g(^ 0) + P^""' 

P^{9')+P^{<P) 



s = ^±^ — ^^u;.. ^B .r' '"^ <i (10) 



For state (8), a violation of this inequality occurs with S ~ 1.0157, and with angles given by 
^ = 0,0 = -tt/A,9' = 7r/2,0' = -37r/4 0. For state (9), violation given by S = 1.008 is 
obtained for angles 9 = 0.427r, = -0.287r, 9' = 0.287r, 0' = 0.427r 0. The above violations 
also hold for the states generated by phase shifting d by 180°, with the choice of angles for 
as before, but replacing 9 with 9 + n and 9' with 9' + vr. 

Violation of the Bell inequality at the level predicted by quantum mechanics ensures 
that no interference by Eve has occurred along d (see Ekert S). Suppose Eve performs a 
measurement on the field d, measuring say to obtain a result xg,,. She then generates 
and transmits to Bob a state \^X0 .e^ >■ The density operator for the new combined system 
is p = Pxg^fioPxeQfio where p^g^^Oo ~< ^Sol^ >< "^l^Oo > is the reduced density matrix for field 
b given the measurement by Eve, {xg^ > is the eigenstate of X^, and Pxg^^g^ = \^xg^^,eo >< 



7 



^xeQ,eo\- Bob tests for the Bell inequality using P^y{6, 0), the joint probability for respective 
results X and y for measurements and X^. With intervention, 

< xe\^xog,eo >< ^xoo,eo\^e > (11) 

where P{xq^,Oq) is the probability that Eve obtains a result xq^ for her measurement. We 
have the form P^^yiO,(j)) = J p(A) p-^i^O, X)py{(f), X) dX from which a Bell inequality fol- 
lows, regardless of the state regenerated by Eve. 

In terms of feasibility, the second scheme based on the Bell inequality is more likely to 
be limited by difficulty of state preparation and susceptibility to loss [r] = 0.96 destroys 
violations E3)and is greatly limited by its use of redundancy. 

The first scheme, not so limited, may offer advantages over schemes utilizing photon 
counting. The high detection efficiencies give a very much reduced overall loss factor, which 
may make it possible to transmit directly and efficiently a predetermined message, later 
checking providing a means to check security. The generation and detection of EPR corre- 
lations with j„jAp j„j = 0.7 has been achieved O. The generation of squeezed (where 
A'^X^ < 1 for some 6) optical and soliton pulses 111 opens up possibilities for transmission 
of EPR correlated fields. The robustness of squeezing to propagation loss has not been 
keenly explored, but similar distances should be achievable for EPR correlations. This loss 
represents the chief limitation to long distance transmission, since loss acts to degrade the 
EPR correlations which must be kept at j„jAp < 1. Repeated detection and regen- 
eration of the signal with new EPR fields could help combat loss. Security then relies on 
a set of senders and receivers being able to communicate reliably at a later stage, after the 
detections. 

In recent applications ^ EPR beams have been generated as the two outputs of a 
beam splitter with inputs a squeezed vacuum state. It would be possible to use such EPR 
systems for our cryptography scheme where the squeezed vacuum is replaced by an amplitude 
squeezed state. 
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•"IG. 1. Schematic representation of the EPR cryptographic scheme. The EPR device generates 
fields a and b which are EPR correlated. The bit value is given by Alice's choice of input to a. 




FIG. 2. Schematic plot of the probability distribution P = P{x) for obtaining a result x upon 
measurement of the quadrature phase amplitude of a or b, where one gaussian peak represents 
input laoexp*'^/^ >a (bit value 1) and the other input |aiexp*'^/^ (bit value 0). Bob is able 
to infer the bit value from x and record, for later communication to Alice, the deviation X of his 
result from the (known) mean of the distribution as indicated. 
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